Changelog for the libssh2 project. Generated with git2news.pl

Daniel Stenberg (16 Oct 2024)

- RELEASE-NOTES: 1.11.1

Viktor Szakats (8 Oct 2024)

- RELEASE-NOTES: sync [ci skip]

- [Anders Borum brought this change]

session: support server banners up to 8192 bytes (was: 256)

If server had banner exceeding 256 bytes there wasn't enough room in

`_LIBSSH2_SESSION.banner_TxRx_banner`. Only the first 256 bytes would be

read making the first packet read fail but also dooming key exchange as

`session->remote.banner` didn't include everything.

This change bumps the banner buffer to 8KB to match OpenSSH.

Fixes #1442

Closes #1443

- RELEASE-NOTES: sync [ci skip]

- cmake: sync and improve Find modules, add `pkg-config` native detection

- sync code between Find modules.

- wolfssl: replace `pkg-config` hints with native detection.

- libgcrypt, mbedtls: add `pkg-config`-based native detection.

- libgcrypt: add version detection.

- limit `pkg-config` use for `UNIX`, vcpkg, and non-cross MinGW builds,

and builds with no manual customization via `*_INCLUDE_DIR` or

`*_LIBRARY`.

- replace and sync Find module header comments.

- ci: delete manual mbedTLS config that's now redundant.

Based on similar work done in curl.

Second attempt at #1420

Closes #1445

- cmake: initialize `LIBSSH2_LIBDIRS` [ci skip]

Follow-up to c87f12963037b22e6b60411c9c2d6513c06e2f03 #1466

- ci/appveyor: fix and bump OpenSSL 3 path, add path check

Follow-up to b5e68bdc37c6afa0dc777794dda8307167919d04 #1461

Closes #1468

- cmake: link to OpenSSL::Crypto, not OpenSSL::SSL

Follow-up to 82b09f9b3aae97f641fbcc2d746d2a6383abe857 #1322

Follow-up to c84745e34e53f863ffba997ceeee7d43d1c63a4b #1128

Cherry-picked from #1445

Closes #1467

- cmake: generate `LIBSSH2_PC_LIBS_PRIVATE` dynamically

Generate `LIBSSH2_PC_LIBS_PRIVATE` from `LIBSSH2_LIBS`.

Also add extra libdirs (`-L`) to `Libs` and `Libs.private`.

Logic copied from curl.

Closes #1466

- cmake: initialize `LIBSSH2_PC_REQUIRES_PRIVATE` [ci skip]

Follow-up to 0fce9dcc2909ffff5f4a1a1bc3d359fc7f409299 #1464

- cmake: add comment about `ibssh2.pc.in` variables [ci skip]

- cmake: support absolute `CMAKE_INSTALL_INCLUDEDIR`/`CMAKE_INSTALL_LIBDIR`

in `libssh2.pc`.

Also use `${exec_prefix}` (instead of `${prefix}`) as a base for `libdir`.

Closes #1465

- cmake: rename two variables and initialize them

- `LIBRARIES` -> `LIBSSH2_LIBS`

- `SOCKET_LIBRARIES` -> `LIBSSH2_LIBS_SOCKET`

Also initialize them before use.

Cherry-picked from #1445

Closes #1464

- ci/appveyor: reduce test runs (workaround for infrastructure permafails)

Jobs consistently fail to connect to the test server (run in GHA) since

2024-Aug-29:

https://ci.appveyor.com/project/libssh2org/libssh2/builds/50498393

There was an earlier phase of failures one month before that, that got

fixed by increasing the wait for the server in

bf3af90b3f1bb14cf452df7a8eb55cc9088f3e7f.

Thus, skip running tests in AppVeyor CI jobs, except: After some

experiments, it seems that running tests with the last OpenSSL job and

the last WinCrypt job _work_, which still leaves some coverage.

It remains to be seen how stable this is.

This is meant as a temporary fix till there is a solution to make all

jobs run tests reliable like up until a few months ago.

Closes #1461

- [Patrick Monnerat brought this change]

os400: drop vsprintf() use

Follow-up to discussion in #1457

Plus e-mail address update.

Closes #1462

- RELEASE-NOTES: sync [ci skip]

Daniel Stenberg (30 Sep 2024)

- openssl: free allocated resources when using openssl3

Reproduces consistently with curl test case 638

Closes #1459

Viktor Szakats (28 Sep 2024)

- checksrc: update, check all sources, fix fallouts

update from curl:

https://github.com/curl/curl/blob/cff75acfeca65738da8297aee0b30427b004b240/scripts/checksrc.pl

Closes #1457

- cmake: prefer `find_dependency()` in `libssh2-config.cmake`

CMake manual suggest using `find_dependency()` (over `find_package()`)

in `config.cmake` scripts.

Ref: https://cmake.org/cmake/help/latest/module/CMakeFindDependencyMacro.html

Closes #1460

- ci: use Ninja with cmake

Closes #1458

GitHub (27 Sep 2024)

- [dksslq brought this change]

Fix memory leaks in _libssh2_ecdsa_curve_name_with_octal_new and _libssh2_ecdsa_verify (#1449)

Better error handling in`_libssh2_ecdsa_curve_name_with_octal_new` and `_libssh2_ecdsa_verify` to prevent leaks.

Credit: dksslq <dksslq@github.com>

- [rolag brought this change]

Fix unstable connections over nonblocking sockets (#1454)

The `send_existing()` function allows partially sent packets to be sent

fully before any further packets are sent. Originally this returned

`LIBSSH2_ERROR_BAD_USE` when a different caller or thread tried to send

an existing packet created by a different caller or thread causing the

connection to disconnect. Commit 33dddd2f8ac3bc81 removed the return

allowing any caller to continue sending another caller's packet. This

caused connection instability as discussed in #1397 and confused the

client and server causing occasional duplicate packets to be sent and

giving the error `rcvd too much data` as discussed in #1431. We return

`LIBSSH2_ERROR_EAGAIN` instead to allow existing callers to finish

sending their own packets.

Fixes #1397

Fixes #1431

Related #720

Credit: klux21, rolag

- [Will Cosgrove brought this change]

Prevent possible double free of hostkey (#1452)

NULL server hostkey based on fuzzer failure case.

Viktor Szakats (7 Sep 2024)

- cmake: tidy up syntax, minor improvements

- make internal variables underscore-lowercase.

- unfold lines.

- fold lines setting header directories.

- fix indent.

- drop interim variable `EXAMPLES`.

- initialize some variables before populating them.

- clear a variable after use.

- add `libssh2_dumpvars()` function for debugging.

- allow to override default `CMAKE_UNITY_BUILD_BATCH_SIZE`.

- bump up default `CMAKE_UNITY_BUILD_BATCH_SIZE` to 0 (was 32).

- tidy up option descriptions.

Closes #1446

- cmake: rename mbedTLS and wolfSSL Find modules

To match the curl ones.

Cherry-picked from #1445

- RELEASE-NOTES: sync [ci skip]

- cmake: fixup version detection in mbedTLS find module

- avoid warning with 2.x versions about missing header file while

extracting the version number.

- clear temp variables.

Closes #1444

- buildconf: drop

Use `autoreconf -fi` instead.

Follow-up to fc5d77881eb6bb179f831e626d15f4f29179aad5

Closes #1441

- [Michael Buckley brought this change]

Implement chacha20-poly1305@openssh.com

Probably the biggest and potentially most controversial change we have

to upstream.

Because earlier versions of OpenSSL implemented the algorithm before

standardization, using an older version of OpenSSL can cause problems

connecting to OpenSSH servers. Because of this, we use the public domain

reference implementation instead of the crypto backends, just like

OpenSSH does.

We've been holding this one for a few years. We were about to upstream

it around the same time as aes128gcm landed upstream, and the two

changes were completely incompatible. Honestly, it took me weeks to

reconcile these two implementations, and it could be much better.

Our original implementation changed every crypt method to decrypt the

entire message at once. the AESGCM implementation instead went with this

firstlast design, where a firstlast paramater indicates whether this is

the first or last call to the crypt method for each message. That added

a lot of bookkeeping overhead, and wasn't compatible with the chacha

public domain implementation.

As far as I could tell, OpenSSH uses the technique of decrypting the

entire message in one go, and doesn't have anything like firstlast.

However, I could not get out aes128gcm implementation to work that way,

nor could I get the chacha implementation to work with firstlast, so I

split it down the middle and let each implementation work differently.

It's kind of a mess, and probably should be cleaned up, but I don't have

the time to spend on it anymore, and it's probably better to have

everything upstream.

Fixes #584

Closes #1426

- tidy-up: do/while formatting

Also fix an indentation and delete empty lines.

Closes #1440

- wolfssl: drop header path hack

The wolfSSL OpenSSL headers reside in `wolfssl/openssl/*.h`.

Before this patch the wolfSSL OpenSSL compatibilty header includes were

shared with the native OpenSSL codepath, and used `openssl/*h`. For

wolfSSL builds this required a hack to append the

`<wolfssl-prefix>/wolfssl` directory to the header search path, to find

the headers.

This patch changes the source to use the correct header references,

allowing to drop the header path hack.

Also fix to use the correct variable to set up the header path in CMake:

`WOLFSSL_INCLUDE_DIRS` (was: `WOLFSSL_INCLUDE_DIR`, without the `S`)

Closes #1439

- cmake: mbedTLS detection tidy-ups

- set and use `MBEDTLS_INCLUDE_DIRS`.

- stop marking `MBEDTLS_LIBRARIES` as advanced.

Closes #1438

- cmake: add quotes, delete ending dirseps

Follow-up to 3fa5282d6284efba62dc591697e6a687152bdcb1 #1166

Closes #1437

- CI/appveyor: increase wait for SSH server on GHA [ci skip]

Blind attempt to make AppVeyor CI tests work again.

- disable DSA by default

Also:

- add `LIBSSH2_DSA_ENABLE` to enable it explicitly.

- test the above option in CI.

- say 'deprecated' in docs and public header.

- disable DSA in the CI server config.

(OpenSSH 9.8 no longer builds with it by default)

https://www.openssh.com/txt/release-9.8

Patch-by: Jose Quaresma

- disable more DSA code when not enabled.

Fixes #1433

Closes #1435

GitHub (30 Jul 2024)

- [Viktor Szakats brought this change]

tidy-up: link updates (#1434)

Marc Hoersken (27 Jul 2024)

- ci/GHA: revert concurrency and improve permissions

Statuses are per AppVeyor event and commit, not pull-request.

Also align permissions approach with curl, least priviledge.

Partially reverts b08cfbc99fa4df3459db4e1ccf4263fd260e9b15.

GitHub (23 Jul 2024)

- [Will Cosgrove brought this change]

Always init mbedtls_pk_context (#1430)

In the failure case, mbedtls_pk_context could be free'd without first being initialized.

- [Viktor Szakats brought this change]

mbedtls: tidy-up (#1429)

- [Will Cosgrove brought this change]

Correctly initialize values (#1428)

Fix regression with commit from #1421

Viktor Szakats (14 Jul 2024)

- RELEASE-NOTES: sync [ci skip]

- [Seo Suchan brought this change]

mbedtls: expose `mbedtls_pk_load_file()` for our use

While it's moved to pk_internal, it won't removed in mbedTLS 3.6 LTS

so it's safe to redeclare it on our side to find it.

This is implementing emergency fix suggested from

https://github.com/libssh2/libssh2/commit/2e4c5ec4627b3ecf4b6da16f365c011dec9a31b4#commitcomment-141379351

Follow-up to e973493f992313b3be73f51d3f7ca6d52e288558 #1393

Follow-up to 2e4c5ec4627b3ecf4b6da16f365c011dec9a31b4 #1349

Closes #1421

GitHub (13 Jul 2024)

- [Viktor Szakats brought this change]

ci/GHA: simplify mbedTLS build hack for autotools (#1425)

Follow-up to e973493f992313b3be73f51d3f7ca6d52e288558 #1393

- [Michael Buckley brought this change]

Always check for null pointers before calling _libssh2_bn_set_word (#1423)

- [Viktor Szakats brought this change]

ci/GHA: FreeBSD 14.1, actions bump (#1424)

- [Michael Buckley brought this change]

Increase SFTP_HANDLE_MAXLEN back to 4092 (#1422)

Match OpenSSH for compatibility.

Viktor Szakats (10 Jul 2024)

- ci/GHA: tidy up casing [ci skip]

- REUSE: fix typo in comment

- REUSE: shorten and improve

Follow-up to 70b8bf314cf4566a7529c5d6eae63097a926abb0 #1419

- REUSE: upgrade to `REUSE.toml`

Closes #1419

- build: stop detecting `sys/param.h` header

This header is no longer used.

Follow-up to 12427f4fb8e789adcee4a6e30974932883915e88 #1415

Closes #1418

- [Nicolas Mora brought this change]

tests: avoid using `MAXPATHLEN`, for portability

`MAXPATHLEN` is not present in some systems, e.g. GNU Hurd.

Co-authored-by: Viktor Szakats

Ref: 54bef4c5dad868a9d45fdbfca9729b191c0abab5 #198

Fixes #1414

Closes #1415

- cmake: sync formatting in `cmake/Find*` modules

- [Michael Buckley brought this change]

sftp: implement posix-rename@openssh.com

Add a new function `libssh2_sftp_posix_rename_ex()` and

`libssh2_sftp_posix_rename()`, which implement

the posix-rename@openssh.com extension.

If the server does not support this extension, the function returns

`LIBSSH2_FX_OP_UNSUPPORTED` and it's up to the user to recover, possibly

by calling `libssh2_sftp_rename()`.

Co-authored-by: Viktor Szakats (bump to size_t)

Closes #1386

- src: use `UINT32_MAX`

Needs to be defined for platforms missing it, e.g. VS2008.

Closes #1413

GitHub (25 Jun 2024)

- [Michael Buckley brought this change]

Fix a memory leak in key exchange. (#1412)

Original fix submitted as a patch by Trzik.

Co-authored-by: Michael Buckley <michael@panic.com>

Viktor Szakats (25 Jun 2024)

- RELEASE-NOTES: sync [ci skip]

- wolfssl: fix `EVP_Cipher()` use with v5.6.0 and older

Add workaround for the wolfSSL `EVP_Cipher(*p, NULL, NULL, 0)` bug to

make libssh2 work with wolfSSL v5.6.0 and older.

wolfSSL fixed this issue in v5.7.0:

https://github.com/wolfSSL/wolfssl/pull/7143

https://github.com/wolfSSL/wolfssl/commit/b0de0a1c95119786cf5651dd76dd7d7bdfac5a04

Without our local workaround:

- v5.3.0 and older fail most tests:

Ref: https://github.com/libssh2/libssh2/actions/runs/9646827522/job/26604211476#step:17:1263

- v5.4.0, v5.5.x, v5.6.0 fail these:

```

29 - test_read-aes128-cbc (Failed)

30 - test_read-aes128-ctr (Failed)

32 - test_read-aes192-cbc (Failed)

33 - test_read-aes192-ctr (Failed)

34 - test_read-aes256-cbc (Failed)

35 - test_read-aes256-ctr (Failed)

```

Ref: https://github.com/libssh2/libssh2/actions/runs/9646827522/job/26604233819#step:17:978

Oddly enough the workaround breaks OpenSSL tests, so only enable it for

the affected wolfSSL versions.

Also add new build-from-source wolfSSL CI job to test the new codepath.

wolfSSL has a build bug where `wolfssl/options.h` and

`wolfssl/version.h` are not copied to the `install` destination with

autotools. With CMake it has a different bug where `wolfcrypt/sp_int.h`

is not copied (with v5.4.0). And another with CMake where `FIPS_mode()`

remains missing (with v5.6.0 and earlier.)

Therefore use CMake with v5.5.4 and a workaround for `FIPS_mode()`.

Another option is autotools with v5.4.0 and a workaround for `install`,

but CMake builds quicker.

Regression-from 3c953c05d67eb1ebcfd3316f279f12c4b1d600b4 #797

Fixes #1020

Fixes #1299

Assisted-by: Michael Buckley via #1394

Closes #1394 (another attempt to fix the mentioned wolfSSL bug)

Closes #1407

- wolfssl: bump version in upstream issue comment [ci skip]

- wolfssl: require v5.4.0 for AES-GCM

Earlier versions crash while running tests.

This patch is part of a series of fixes to make wolfSSL AES-GCM support

work together with libssh2.

Possibly related is this wolfSSL bugfix patch, released in v5.4.0:

https://github.com/wolfSSL/wolfssl/pull/5205

https://github.com/wolfSSL/wolfssl/commit/fb3c611275dfe454c331baa0818445a0406c208a

"Fix another AES-GCM EVP control command issue"

Ref: #1020

Ref: #1299

Cherry-picked from #1407

Closes #1411

- tests: fix excluding AES-GCM tests

Replace hard-coded crypto backends and rely on `LIBSSH2_GCM` macro

to decide whether to run AES-GCM tests.

Without this, build attempted to run AES-GCM tests (and failed)

for crypto backends that have conditional support for this feature, e.g.

wolfSSL without the necessary features built-in

(as in before Homewbrew wolfssl 5.7.0_1, or OpenSSL v1.1.0 and older).

This patch is part of a series of fixes to make wolfSSL AES-GCM support

work together with libssh2.

Cherry-picked from #1407

Closes #1410

- ci/GHA: fix wolfSSL-from-source AES-GCM tests

Turns out these tests:

```

31 - test_read-aes128-gcm@openssh.com (Failed)

36 - test_read-aes256-gcm@openssh.com (Failed)

```

were failing because AES-GCM wasn't enabled in libssh2. This in turn

happened because the `WOLFSSL_AESGCM_STREAM` macro wasn't enabled while

building wolfSSL. Which happened because this macro isn't enabled by

any CMake-level wolfSSL option. Passing it as `CPPFLAGS` fixes it.

This allows enabling tests with wolfSSL 5.7.0.

Follow-up to d4cea53f53c78febad14b4caa600e25d1aaf92fd #1408

Closes #1409

- ci/GHA: add Linux job with latest wolfSSL built from source

After this patch it's possible to run tests with wolfSSL 5.7.0.

wolfSSL 5.7.0 fixes this bug that affects open issues #1020 and #1299:

https://github.com/wolfSSL/wolfssl/pull/7143

`-DWOLFSSL_OPENSSLALL=ON` is necessary for `wolfSSL_FIPS_mode()`

Closes #1408

- ci/GHA: tidy up build-from-source steps [ci skip]

- make curl downloads less verbose.

- fix cmake warning:

```

CMake Warning:

No source or binary directory provided. Both will be assumed to be the

same as the current working directory, but note that this warning will

become a fatal error in future CMake releases.

```

Ref: https://github.com/libssh2/libssh2/actions/runs/9509866494/job/26213472410#step:5:32

- [Adam brought this change]

src: fix type warning in `libssh2_sftp_unlink` macro

The `libssh2_sftp_unlink` macro was implicitly casting the `size_t`

returned by `strlen` to the `unsigned int` type expected by

`libssh2_sftp_unlink_ex`.

This fix adds an explicit cast to match similar macro definitions in

the same file (e.g. `libssh2_sftp_rename`, `libssh2_sftp_mkdir`).

Closes #1406

- libssh2.pc: reference mbedcrypto pkgconfig

mbedtls 3.6.0 got pkgconfig support:

https://github.com/Mbed-TLS/mbedtls/commit/a4d17b34f354557838e05d2cb47200e8dcaaf59b

Reference it from `libssh2.pc`.

Closes #1405

- tidy-up: typo in comment [ci skip]

- RELEASE-NOTES: sync [ci skip]

Also bump planned deprecation dates.

- ci/GHA: show configure logs on failure and other tidy-ups

- dump cmake error log on configure failure. (for cmake 3.26 and newer)

- dump `config.log` on autotools configure failure.

- convert specs filename to Windows format before passing to CMake.

- add missing quotes.

Closes #1403

- ci/GHA: bump parallel jobs to nproc+1

Ref: https://docs.github.com/en/actions/using-github-hosted-runners/about-github-hosted-runners/about-github-hosted-runners#standard-github-hosted-runners-for-public-repositories

Closes #1402

- ci/GHA: show test logs on failure

Closes #1401

- ci/GHA: fix `Dockerfile` failing after Ubuntu package update

Likely due an upstream Ubuntu package update (requiring an apt-get

install call beforehand), tests run via autotools started failing with

no change in the libssh2 repo:

```

FAIL: test_aa_warmup

====================

Error running command 'docker build --quiet -t libssh2/openssh_server %s' (exit 256): Dockerfile:10

--------------------

8 | && apt-get clean \

9 | && rm -rf /var/lib/apt/lists/*

10 | >>> RUN mkdir /var/run/sshd

11 |

12 | # Chmodding because, when building on Windows, files are copied in with

--------------------

ERROR: failed to solve: process "/bin/sh -c mkdir /var/run/sshd" did not complete successfully: exit code: 1

Failed to build docker image

Cannot stop session - none started

Cannot stop container - none started

Command: docker build --quiet -t libssh2/openssh_server ../../tests/openssh_server

FAIL test_aa_warmup (exit status: 1)

```

Ref: https://github.com/libssh2/libssh2/actions/runs/9322194756/job/25662748095#step:11:390

Fix it by skipping `mkdir` if `/var/run/sshd` already exists.

(Why cmake-based jobs aren't affected, I don't know.)

Ref: https://github.com/libssh2/libssh2/commit/50143d5867d35df76a6cf589ca8a13b22105aa64#commitcomment-142560875

Closes #1400

- ci/GHA: use ubuntu-latest with OmniOS job

It's the same as ubuntu-22.04.

Also update OmniOS package search link.

- ci: disable dependency tracking in autotools builds

For better build performance. Dependency tracking causes a build

overhead while compiling to help a subsequent build, but in CI there is

never one and the extra work is discarded.

Closes #1396

- mbedtls: fail to compile with v3.6.0 outside CI

A compile-time failure is preferred over an unexpected one at

runtime.

The problem is silenced with a macro in CI and this macro will have

to be added to more platforms when mbedTLS v3.6.0 reaches them.

Follow-up to 2e4c5ec4627b3ecf4b6da16f365c011dec9a31b4 #1349

Closes #1393

- tests: drop default cygpath option `-u`

- tidy-up: fix typo found by codespell

Ref: https://github.com/libssh2/libssh2/actions/runs/9224795055/job/25380857082?pr=1393#step:4:5

- ci/GHA: shell syntax tidy-up

Closes #1390

- RELEASE-NOTES: sync [ci skip]

- ci/GHA: bump NetBSD/OpenBSD, add NetBSD arm64 job

OpenBSD arm64 jobs were very slow, so skipped that.

Closes #1388

- autotools: fix to update `LDFLAGS` for each detected dependency

autotools lib detection routine failed to extend LDFLAGS for each

detection. This could cause successful detection of a dependency, but

later failing to use it. This did not cause an issue as long as all

dependencies lived under the same prefix, but started breaking on macOS

ARM + Homebrew where this was no longer true for mbedTLS and zlib in

particular.

Follow-up to 844115393bffb4e92c6569204cbe4cd8e553480d #1381

Follow-up to ae2770de25949bc7c74e60b4cc6a011bbe1d3d7c #1377

Closes #1384

GitHub (8 May 2024)

- [Michael Buckley brought this change]

OpenSSL 3: Fix calculating DSA public key (#1380)

Viktor Szakats (8 May 2024)

- ci/GHA: tidy-up wolfSSL autotools config on macOS

Closes #1383

- ci/GHA: shorter mbedTLS autotools workaround

Follow-up to 844115393bffb4e92c6569204cbe4cd8e553480d #1381

Closes #1382

GitHub (8 May 2024)

- [Michael Buckley brought this change]

ci: fix mbedtls runners on macOS (#1381)

Sets LDFLAGS while configuring the autoconf mbedTLS build for macOS.

Viktor Szakats (29 Apr 2024)

- RELEASE-NOTES: sync [ci skip]

- [binary1248 brought this change]

wincng: fix `DH_GEX_MAXGROUP` set higher than supported

In 1c3a03ebc3166cf69735111aba2b8cee57cdba51 #493,

`LIBSSH2_DH_GEX_MAXGROUP` was introduced to specify

crypto-backend-specific modulus sizes. Unfortunately, the max size for

the wincng DH modulus was defined to 8192, probably because this is the

value most other backends support.

According to Microsoft documentation [1], `BCryptGenerateKeyPair`

currently only supports up to 4096-bit keys when the selected algorithm

is `BCRYPT_DH_ALGORITHM`. Requesting larger keys when calling

`BCryptGenerateKeyPair` in `_libssh2_dh_key_pair` always results in

`STATUS_INVALID_PARAMETER` being returned and ultimately key exchange

failing.

When attempting to connect to any server that offers 8192 bit DH, this

causes key exchange to always fail when using the wincng backend.

Reducing `LIBSSH2_DH_GEX_MAXGROUP` to 4096 fixes the issue.

[1] https://learn.microsoft.com/en-us/windows/win32/api/bcrypt/nf-bcrypt-bcryptgeneratekeypair

Closes #1372

- build: silence warnings inside `FD_SET()`/`FD_ISSET()` macros

Use an ugly workaround to silence `-Wsign-conversion` warnings triggered

by the internals of `FD_SET()`/`FD_ISSET()` macros. They've been showing

up in OmniOS CI builds when compiling `example` programs. They also have

been seen with older Cygwin and other envs and configurations.

Also scope two related variables in examples.

E.g.:

```

../../example/direct_tcpip.c:251:9: warning: conversion to 'long unsigned int' from 'libssh2_socket_t' {aka 'int'} may change the sign of the result [-Wsign-conversion]

251 | FD_SET(forwardsock, &fds);

| ^~~~~~

../../example/direct_tcpip.c:251:9: warning: conversion to 'long unsigned int' from 'libssh2_socket_t' {aka 'int'} may change the sign of the result [-Wsign-conversion]

../../example/direct_tcpip.c:251:9: warning: conversion to 'long unsigned int' from 'long int' may change the sign of the result [-Wsign-conversion]

../../example/direct_tcpip.c:251:9: warning: conversion to 'long int' from 'long unsigned int' may change the sign of the result [-Wsign-conversion]

../../example/direct_tcpip.c:259:18: warning: conversion to 'long unsigned int' from 'libssh2_socket_t' {aka 'int'} may change the sign of the result [-Wsign-conversion]

259 | if(rc && FD_ISSET(forwardsock, &fds)) {

| ^~~~~~~~

../../example/direct_tcpip.c:259:18: warning: conversion to 'long unsigned int' from 'libssh2_socket_t' {aka 'int'} may change the sign of the result [-Wsign-conversion]

../../example/direct_tcpip.c:259:18: warning: conversion to 'long unsigned int' from 'long int' may change the sign of the result [-Wsign-conversion]

```

Ref: https://github.com/libssh2/libssh2/actions/runs/8854199687/job/24316762831#step:3:2020

Closes #1379

- autotools: use `AM_CFLAGS`

Use `AM_CFLAGS` to pass custom, per-target C flags. This replaces using

`CFLAGS` which triggered this warning when running `autoreconf -fi`:

```

tests/Makefile.am:8: warning: 'CFLAGS' is a user variable, you should not override it;

tests/Makefile.am:8: use 'AM_CFLAGS' instead

```

(Only for `tests`, even though `example` and `src` also used this

method. The warning is also missing from curl, that also uses

`CFLAGS`.)

Follow-up to 3ec53f3ea26f61cbf2e0fbbeccb852fca7f9b156 #1286

Closes #1378

GitHub (25 Apr 2024)

- [Viktor Szakats brought this change]

ci/GHA: fix gcrypt with autotools/macOS/Homebrew/ARM64 (#1377)

mbedtls configure fails to detect anything due to this:

```

configure:23101: gcc -o conftest -g -O2 -I/opt/homebrew/include conftest.c -lmbedcrypto -lz >&5

ld: library 'mbedcrypto' not found

clang: error: linker command failed with exit code 1 (use -v to see invocation)

```

Viktor Szakats (25 Apr 2024)

- autotools: delete bogus square bracket from help text [ci skip]

Follow-up to 3f98bfb0900b5e68445a339cfebc60b307a24650 #1368

GitHub (25 Apr 2024)

- [Viktor Szakats brought this change]

ci/GHA: fix verbose option for autotools jobs (#1376)

Also enable verbose for macOS `make` step.

- [Viktor Szakats brought this change]

ci/GHA: dump `config.log` on failure for macOS autotools jobs (#1375)

- [Viktor Szakats brought this change]

ci/GHA: fix `autoreconf` failure on macOS/Homebrew (#1374)

By manually installing `libtool`.

```

autoreconf -fi

shell: /bin/bash -e {0}

configure.ac:75: error: possibly undefined macro: AC_LIBTOOL_WIN32_DLL

If this token and others are legitimate, please use m4_pattern_allow.

See the Autoconf documentation.

configure.ac:76: error: possibly undefined macro: AC_PROG_LIBTOOL

autoreconf: error: /opt/homebrew/Cellar/autoconf/2.72/bin/autoconf failed with exit status: 1

```

Ref: https://github.com/libssh2/libssh2/actions/runs/8833608758/job/24253334557#step:4:1

- [Viktor Szakats brought this change]

ci/GHA: fixup Homebrew location (for ARM runners) (#1373)

GHA macOS runners became ARM64 machines. Make the Homebrew prefix

dynamic to adapt to these installations.

Viktor Szakats (14 Apr 2024)

- RELEASE-NOTES: sync [ci skip]

- [Patrick Monnerat brought this change]

os400: Add two recent files to the distribution

Closes #1364

- wincng: add to ci/GHA, add `./configure` option `--enable-ecdsa-wincng`

- add `./configure` option `--enable-ecdsa-wincng`

- add WinCNG autotools jobs to GHA.

- enable WinCNG ECDSA in some GHA jobs (both CMake and autotools).

Follow-up to 3e72343737e5b17ac98236c03d5591d429b119ae #1315

Closes #1368

GitHub (14 Apr 2024)

- [Johannes Passing brought this change]

wincng: add ECDSA support for host and user authentication (#1315)

The WinCNG backend currently only supports DSA and RSA. This PR

adds ECDSA support for host and user authentication.

* Disable WinCNG ECDSA support by default to maintain backward

compatibility for projects that target versions below Windows 10.

* Add cmake option `ENABLE_ECDSA_WINCNG` to guard ECDSA support.

* Update AppVeyor job matrix to only enable ECDSA on Server 2016+

Viktor Szakats (14 Apr 2024)

- ci: enable Unity mode for most CMake builds

Ref: 7129ea9ca8cca86dac80a6bac2d63937987efe9d #1034

Closes #1367

- os400: fix shellcheck warnings in scripts (fixups)

- Build scripts must be executed by the os/400 shell (sh), not bash which

is a PASE program: The `-ot` non-POSIX test extension works in os/400 as

well. Ref: https://github.com/libssh2/libssh2/pull/1364#issue-2241646754

- Drop/fixup mods trying to make some syntax highlighters happier.

Follow-up to c6625707b94d9093f38f1a0a4d89c11b64f12ba8 #1358

Assisted-by: Patrick Monnerat

Closes #1364

Closes #1366

- cmake: style tidy-up (more)

Follow-up to 3fa5282d6284efba62dc591697e6a687152bdcb1 #1166

Closes #1365

- RELEASE-NOTES: sync [ci skip]

- os400: fix shellcheck warnings in scripts

- use `$()` instead of backticks, and re-arrange double-quotes inside.

- add missing `|| exit 1` to `cd` calls. (could be dropped by using `set -eu`.)

- add `-n` to a few `if`s.

- shorten redirections by using `{} >` (as shellcheck recommended).

- silence warnings where variables were detected as unused (SC2034).

- a couple misc updates to silence warnings.

- switch to bash shebang for `-ot` feature.

- split two lines to unbreak syntax highlighting in my editor. (`$(expr \`, `$(dirname \`)

Also enable CI checks for OS/400 shell scripts.

Ref: d88b9bcdafe9d19aad2fb120d0a0acb3edab64f7

Closes #1358

- RELEASE-NOTES: sync [ci skip]

- ci: add shellcheck job and script

Add FIXME for OS/400 scripts.

Cherry-picked from #1358

- tests: fix shellcheck issues in `test_sshd.test`

Cherry-picked from #1358

- RELEASE-NOTES: sync [ci skip]

GitHub (9 Apr 2024)

- [Viktor Szakats brought this change]

ci/appveyor: re-enable OpenSSL 3, also bump to 3.2.1 (#1363)

Ref: 104744f4a523de574ce3767c50948d9b8385be4c #1348

Viktor Szakats (9 Apr 2024)

- ci: use a better test timestamp [ci skip]

Mar 27 2024 08:00:00 GMT+0000

Follow-up to 2d765e454d98b794a5e5bbc497b1fcba4a9b8c4b #1360

GitHub (9 Apr 2024)

- [Viktor Szakats brought this change]

ci: verify build and install from tarball (#1362)

Install verification based on:

https://github.com/curl/curl/blob/28c5ddf13ac311d10bc4e8f9fc4ce0858a19b888/scripts/installcheck.sh

Viktor Szakats (9 Apr 2024)

- tidy-up: dir names, command-line [ci skip]

Follow-up to 2d765e454d98b794a5e5bbc497b1fcba4a9b8c4b #1360

- cmake: tidy up function name casing in `CopyRuntimeDependencies.cmake`

Use lowercase to match callers.

GitHub (9 Apr 2024)

- [Viktor Szakats brought this change]

ci: add reproducibility test for `maketgz` (#1360)

Viktor Szakats (9 Apr 2024)

- maketgz: add reproducible dir entries to tarballs

In the initial implementation of reproducible tarballs, they were

missing directory entries, while .zip archives had them. It meant

that on extracting the tarball, on-disk directory entries got the

current timestamp.

This patch fixes this by including directory entries in the tarball,

with reproducible timestamps. It also moves sorting inside tar,

to ensure reproducible directory entry timestamps on extract

(without the need of `--delay-directory-restore` option, when

extracting with GNU tar. BSD tar got that right by default.)